Orange County Radiation Oncology Medical Group Data Breach Lawsuit Investigation
Were you shocked to learn that your cancer-treatment records and Social Security number may have been exposed? Orange County Radiation Oncology Medical Group (OCRO) has confirmed a major email phishing incident that put sensitive patient data at risk. Act now to see if you can file a claim and safeguard your identity.
Find out how to protect yourself
What Happened?
Integrated Oncology Network (ION), which provides administrative services for OCRO, detected that hackers accessed employee email and SharePoint accounts during a phishing attack from December 13 – 16, 2024. The intrusion was not discovered until June 13, 2025, and OCRO reported the breach to the U.S. Department of Health and Human Services on June 27, 2025.
An estimated 1,911 patients had both personally identifiable information (PII) and protected health information (PHI) exposed during the three-day window.
What Data Was Exposed?
- Full names
- Social Security numbers
- Dates of birth
- Mailing addresses
- Government-issued IDs
- Financial account details
- Diagnosis and treatment information
- Lab results & medication records
- Health-insurance and claims data
- Provider names and dates of service
When Were Patients Notified?
OCRO mailed individual notification letters on June 27, 2025 and posted a public Notice of Email Phishing Incident. The breach details were also filed with:
- U.S. Department of Health & Human Services (HHS Breach Portal)
- California Attorney General’s Office (Data Breach Report)
Your Next Steps
OCRO is offering 12 months of complimentary Epiq Privacy Solutions ID monitoring. While that’s a helpful start, experts recommend taking these additional actions:
- Enroll immediately in the free credit-monitoring service.
- Review bank & credit-card statements for suspicious transactions.
- Place a fraud alert or credit freeze with the three major credit bureaus.
- Be vigilant about phishing emails, texts or calls requesting personal data.
- Save all breach-related correspondence—it may support any future claim.
Can You File a Claim?
If you spent time monitoring accounts, incurred out-of-pocket expenses, or suffered emotional distress because of the OCRO breach, you may be entitled to compensation through a data-breach lawsuit. Potential damages can include:
- Reimbursement for identity-theft costs
- Compensation for lost time
- Recovery of unreimbursed fraudulent charges
- Payment for emotional distress
Timeline of Key Events
- Dec 13–16, 2024: Phishing attack compromises ION email & SharePoint accounts.
- Jun 13, 2025: OCRO learns of the incident from ION.
- Jun 27, 2025: Breach reported to HHS; notification letters mailed to patients.
- Jul 15, 2025: Incident filed with the California Attorney General.
Frequently Asked Questions
How do I know if Orange County Radiation Oncology Medical Group exposed my data?
You should have received a written notice dated June 27, 2025. If you were treated by OCRO between December 13-16, 2024—or had information stored in their systems—contact the practice directly or review the official breach notice.
What should I do if I see unfamiliar charges after the Orange County Radiation Oncology Medical Group breach?
Report the charges to your financial institution immediately, place a fraud alert on your credit file, and keep copies of all correspondence. These records can strengthen any compensation claim.
Is the free credit monitoring from Orange County Radiation Oncology Medical Group enough?
Credit monitoring helps detect suspicious activity, but it doesn’t block new accounts from being opened. Consider adding a credit freeze for maximum protection.
Can I join a class-action lawsuit against Orange County Radiation Oncology Medical Group?
Yes. Individuals whose PII/PHI were compromised may qualify to join a lawsuit seeking damages for financial losses and emotional distress. Use the eligibility button above to learn more.
Will accepting free services prevent me from suing Orange County Radiation Oncology Medical Group?
No. Enrolling in monitoring services typically does not waive your legal rights. Review any terms carefully or consult counsel if you are unsure.
Take Action Today
The clock may already be ticking on your legal rights. Don’t wait until identity thieves strike—take the proactive steps above and explore your legal options now.